Legendary Arena Lab

Provision Droplet

foundations

Migration in progress. api.legendary-arena.com and PostgreSQL are moving from Render to a self-hosted DigitalOcean Ubuntu host behind Cloudflare. Render remains rollback-ready until decommission phase.

Provision Droplet

Create the DigitalOcean host and bootstrap a known-safe baseline before any app deployment.

Summary

This step creates one Ubuntu 24.04 droplet in the selected region, applies cloud-init at creation time, and validates first boot. DNS cutover is intentionally out of scope here and happens later in cutover.

Prerequisites

  • DigitalOcean account and project access
  • SSH public key for operator access
  • Repository copy of infra/cloud-init.yaml
  • Finalized region and size decisions from the migration plan

Create the droplet

  1. Create one new droplet:
    • Image: Ubuntu 24.04 LTS
    • Size: 4 vCPU / 8 GB RAM (initial migration baseline)
    • Region: sfo3 unless traffic data says otherwise
  2. Select SSH key auth only. Do not enable password login.
  3. Set hostname (example: api-prod-01) and migration tags.
  4. Paste infra/cloud-init.yaml into the user-data field.
  5. Provision the droplet and wait for cloud-init completion.

Validate first boot

Run these checks after first login as operator.

# OS baseline
lsb_release -a
uname -r

# cloud-init completion
sudo cloud-init status --long

# operator access
id
sudo -v

# package baseline
command -v curl git jq ufw fail2ban-client

Expected result:

  • Ubuntu 24.04 LTS
  • cloud-init completed with no fatal errors
  • operator has sudo access
  • baseline packages present

Snapshot point

Take a DigitalOcean snapshot after successful validation:

  • Name: pre-hardening-baseline
  • Purpose: fast rollback to clean bootstrap state

What this page does not do

  • Does not harden SSH policy (PermitRootLogin / PasswordAuthentication)
  • Does not enable final firewall policy
  • Does not install Node/PostgreSQL/Nginx runtime stack
  • Does not change Cloudflare DNS

Those actions are covered by later pages and scripts.

References

  • Plan section 1 (locked architecture)
  • Plan section 5.1 (Ubuntu checklist)
  • Plan section 6 (phase sequencing)